diff options
| author | zeripath <art27@cantab.net> | 2019-01-24 14:12:17 +0000 |
|---|---|---|
| committer | Lauris BH <lauris@nix.lv> | 2019-01-24 16:12:17 +0200 |
| commit | 44371b96f56d408ed9af487d482ea021bfabeafa (patch) | |
| tree | ef1255b481b05eba285f1267920097d194ca8cc9 /integrations | |
| parent | cd83c2ca051f9d6a3f7b2842e19aaa2c069cf769 (diff) | |
| download | gitea-44371b96f56d408ed9af487d482ea021bfabeafa.tar.gz gitea-44371b96f56d408ed9af487d482ea021bfabeafa.zip | |
Ensure valid git author names passed in signatures (#5774)
* Ensure valid git author names passed in signatures
Fix #5772 - Git author names are not allowed to include `\n` `<` or `>` and
must not be empty. Ensure that the name passed in a signature is valid.
* Account for pathologically named external users
LDAP and the like usernames are not checked in the same way that users who signup are.
Therefore just ensure that user names are also git safe and if totally pathological -
Set them to "user-$UID"
* Add Tests and adjust test users
Make our testcases a little more pathological so that we be sure that integration
tests have a chance to spot these cases.
Signed-off-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'integrations')
| -rw-r--r-- | integrations/api_user_orgs_test.go | 17 | ||||
| -rw-r--r-- | integrations/user_test.go | 1 |
2 files changed, 12 insertions, 6 deletions
diff --git a/integrations/api_user_orgs_test.go b/integrations/api_user_orgs_test.go index f8372d6115..9b250c0636 100644 --- a/integrations/api_user_orgs_test.go +++ b/integrations/api_user_orgs_test.go @@ -9,7 +9,9 @@ import ( "net/http" "testing" + "code.gitea.io/gitea/models" api "code.gitea.io/sdk/gitea" + "github.com/stretchr/testify/assert" ) @@ -23,14 +25,16 @@ func TestUserOrgs(t *testing.T) { req := NewRequest(t, "GET", urlStr) resp := session.MakeRequest(t, req, http.StatusOK) var orgs []*api.Organization + user3 := models.AssertExistsAndLoadBean(t, &models.User{Name: "user3"}).(*models.User) + DecodeJSON(t, resp, &orgs) assert.Equal(t, []*api.Organization{ { ID: 3, - UserName: "user3", - FullName: "User Three", - AvatarURL: "https://secure.gravatar.com/avatar/97d6d9441ff85fdc730e02a6068d267b?d=identicon", + UserName: user3.Name, + FullName: user3.FullName, + AvatarURL: user3.AvatarLink(), Description: "", Website: "", Location: "", @@ -48,13 +52,14 @@ func TestMyOrgs(t *testing.T) { resp := session.MakeRequest(t, req, http.StatusOK) var orgs []*api.Organization DecodeJSON(t, resp, &orgs) + user3 := models.AssertExistsAndLoadBean(t, &models.User{Name: "user3"}).(*models.User) assert.Equal(t, []*api.Organization{ { ID: 3, - UserName: "user3", - FullName: "User Three", - AvatarURL: "https://secure.gravatar.com/avatar/97d6d9441ff85fdc730e02a6068d267b?d=identicon", + UserName: user3.Name, + FullName: user3.FullName, + AvatarURL: user3.AvatarLink(), Description: "", Website: "", Location: "", diff --git a/integrations/user_test.go b/integrations/user_test.go index 7ff986d546..a6ad164d61 100644 --- a/integrations/user_test.go +++ b/integrations/user_test.go @@ -47,6 +47,7 @@ func TestRenameInvalidUsername(t *testing.T) { "%2f..", "%00", "thisHas ASpace", + "p<A>tho>lo<gical", } session := loginUser(t, "user2") |